magus-cli 0.0.0-placeholder → 7.0.0

package/src/__tests__/git-worktree.test.ts

@@ -0,0 +1,108 @@
+import {
+	afterAll,
+	beforeAll,
+	beforeEach,
+	describe,
+	expect,
+	test,
+} from "bun:test";
+import { execFileSync } from "node:child_process";
+import os from "node:os";
+import path from "node:path";
+import fs from "fs-extra";
+import {
+	clearWorktreeCache,
+	inheritablePaths,
+} from "../services/git-worktree.js";
+
+/**
+ * Exercised against real repositories rather than a mocked `git`, because the
+ * whole point of the function is agreeing with git about what a worktree is.
+ * A stub would have happily confirmed a wrong parse of `worktree list`.
+ */
+
+// Isolate from the operator's git config: a global `core.excludesFile`,
+// `init.defaultBranch`, or commit signing would otherwise leak into these repos.
+const GIT_CFG = [
+	"-c",
+	"user.name=test",
+	"-c",
+	"user.email=test@example.com",
+	"-c",
+	"commit.gpgsign=false",
+	"-c",
+	"init.defaultBranch=main",
+];
+
+const git = (cwd: string, ...args: string[]) =>
+	execFileSync("git", [...GIT_CFG, ...args], { cwd, encoding: "utf8" }).trim();
+
+let base: string;
+let mainTree: string;
+let linked: string;
+
+beforeAll(async () => {
+	// realpath: on macOS os.tmpdir() is a symlink, and git reports real paths.
+	base = await fs.realpath(
+		await fs.mkdtemp(path.join(os.tmpdir(), "magus-worktree-")),
+	);
+	mainTree = path.join(base, "repo");
+	linked = path.join(base, "linked");
+
+	await fs.ensureDir(mainTree);
+	git(mainTree, "init", "-q");
+	await fs.writeFile(path.join(mainTree, "README.md"), "hello\n");
+	git(mainTree, "add", "-A");
+	git(mainTree, "commit", "-qm", "initial");
+	git(mainTree, "worktree", "add", "-q", "-b", "feature", linked);
+});
+
+afterAll(async () => {
+	if (base) await fs.remove(base);
+});
+
+beforeEach(() => {
+	clearWorktreeCache();
+});
+
+describe("inheritablePaths", () => {
+	test("a linked worktree inherits from the main working tree", async () => {
+		expect(await inheritablePaths(linked)).toEqual([mainTree]);
+	});
+
+	test("the main working tree inherits nothing — it holds its own rows", async () => {
+		expect(await inheritablePaths(mainTree)).toEqual([]);
+	});
+
+	test("a subdirectory of a checkout inherits from the repository root", async () => {
+		const sub = path.join(mainTree, "packages", "app");
+		await fs.ensureDir(sub);
+		expect(await inheritablePaths(sub)).toEqual([mainTree]);
+	});
+
+	test("a subdirectory of a linked worktree inherits both roots, nearest first", async () => {
+		const sub = path.join(linked, "packages", "app");
+		await fs.ensureDir(sub);
+		expect(await inheritablePaths(sub)).toEqual([linked, mainTree]);
+	});
+
+	test("a directory outside any repository inherits nothing", async () => {
+		const loose = path.join(base, "not-a-repo");
+		await fs.ensureDir(loose);
+		// Guard: a stray repo above the temp dir would silently invalidate this.
+		const out = await inheritablePaths(loose);
+		expect(out.every((p) => !p.startsWith(base))).toBe(true);
+	});
+
+	test("a missing directory yields nothing rather than throwing", async () => {
+		expect(await inheritablePaths(path.join(base, "gone"))).toEqual([]);
+	});
+
+	test("results are cached per path and cleared on demand", async () => {
+		const first = await inheritablePaths(linked);
+		expect(await inheritablePaths(linked)).toBe(first); // same array identity
+		clearWorktreeCache();
+		expect(await inheritablePaths(linked)).not.toBe(first);
+		expect(await inheritablePaths(linked)).toEqual([mainTree]);
+	});
+});

package/src/__tests__/github-budget.test.ts

@@ -0,0 +1,206 @@
+import { beforeEach, describe, expect, it } from "bun:test";
+import {
+	activeCooldowns,
+	cooldownFor,
+	describeCooldown,
+	formatWait,
+	hostOf,
+	recordRateLimit,
+	recordSuccess,
+	remainingFromHeaders,
+	resetGitHubBudget,
+	waitMs,
+} from "../services/github-budget";
+
+/**
+ * The design hinges on one measured asymmetry (2026-08-17):
+ *
+ *   api.github.com            429/403 carries x-ratelimit-reset and retry-after
+ *   raw.githubusercontent.com 429 carries NEITHER — only a request id and a date
+ *
+ * So the module must be able to say "resets in 4m" when GitHub said so, and must
+ * NOT say it otherwise. Fabricating a reset time would be the same sin as the
+ * original bug: reporting a guess as a fact.
+ */
+
+const NOW = 1_786_980_000_000;
+
+beforeEach(() => {
+	resetGitHubBudget();
+});
+
+describe("hostOf", () => {
+	it("recognises the two budgeted hosts and nothing else", () => {
+		expect(hostOf("https://api.github.com/repos/x/y")).toBe("api.github.com");
+		expect(hostOf("https://raw.githubusercontent.com/x/y/main/f.json")).toBe(
+			"raw.githubusercontent.com",
+		);
+		expect(hostOf("https://github.com/x/y")).toBeNull();
+		expect(hostOf("not a url")).toBeNull();
+	});
+});
+
+describe("recordRateLimit — exact timing when GitHub provides it", () => {
+	it("honours retry-after in seconds", () => {
+		const cooldown = recordRateLimit(
+			"api.github.com",
+			new Headers({ "retry-after": "120" }),
+			NOW,
+		);
+		expect(cooldown.exact).toBe(true);
+		expect(cooldown.until).toBe(NOW + 120_000);
+		expect(describeCooldown(cooldown, NOW)).toBe(
+			"GitHub rate limit resets in 2m",
+		);
+	});
+
+	it("honours retry-after as an HTTP date", () => {
+		const when = new Date(NOW + 300_000).toUTCString();
+		const cooldown = recordRateLimit(
+			"api.github.com",
+			new Headers({ "retry-after": when }),
+			NOW,
+		);
+		expect(cooldown.exact).toBe(true);
+		// UTCString drops sub-second precision, so allow a second of slack.
+		expect(Math.abs(cooldown.until - (NOW + 300_000))).toBeLessThanOrEqual(
+			1000,
+		);
+	});
+
+	it("reads x-ratelimit-reset as epoch SECONDS, not milliseconds", () => {
+		// Treating it as ms lands in 1970, so the cooldown expires instantly and the
+		// UI reports "not rate limited" while GitHub is still refusing every call.
+		const resetEpochSeconds = Math.floor(NOW / 1000) + 600;
+		const cooldown = recordRateLimit(
+			"api.github.com",
+			new Headers({ "x-ratelimit-reset": String(resetEpochSeconds) }),
+			NOW,
+		);
+		expect(cooldown.exact).toBe(true);
+		expect(cooldown.until).toBe(resetEpochSeconds * 1000);
+		expect(waitMs("api.github.com", NOW)).toBeGreaterThan(0);
+	});
+
+	it("caps an implausible server window so a bad header cannot wedge the UI", () => {
+		const cooldown = recordRateLimit(
+			"api.github.com",
+			new Headers({ "retry-after": String(60 * 60 * 24 * 30) }),
+			NOW,
+		);
+		expect(cooldown.until - NOW).toBeLessThanOrEqual(60 * 60_000);
+	});
+});
+
+describe("recordRateLimit — backoff when GitHub provides nothing", () => {
+	it("does not claim a reset time it was never told", () => {
+		// This is the raw.githubusercontent.com case, measured: a bare 429.
+		const cooldown = recordRateLimit(
+			"raw.githubusercontent.com",
+			new Headers(),
+			NOW,
+		);
+		expect(cooldown.exact).toBe(false);
+		expect(describeCooldown(cooldown, NOW)).toContain("next attempt in");
+		expect(describeCooldown(cooldown, NOW)).not.toContain("resets in");
+	});
+
+	it("backs off further on each consecutive failure", () => {
+		const first = recordRateLimit("raw.githubusercontent.com", undefined, NOW);
+		const second = recordRateLimit("raw.githubusercontent.com", undefined, NOW);
+		const third = recordRateLimit("raw.githubusercontent.com", undefined, NOW);
+		expect(second.until).toBeGreaterThan(first.until);
+		expect(third.until).toBeGreaterThan(second.until);
+		expect(third.strikes).toBe(3);
+	});
+
+	it("ignores a retry-after that is garbage or already past", () => {
+		const garbage = recordRateLimit(
+			"raw.githubusercontent.com",
+			new Headers({ "retry-after": "soon-ish" }),
+			NOW,
+		);
+		expect(garbage.exact).toBe(false);
+		expect(garbage.until).toBeGreaterThan(NOW);
+	});
+});
+
+describe("the gate", () => {
+	it("blocks while cooling and clears when the window passes", () => {
+		const cooldown = recordRateLimit(
+			"raw.githubusercontent.com",
+			undefined,
+			NOW,
+		);
+		expect(cooldownFor("raw.githubusercontent.com", NOW)).not.toBeNull();
+		expect(
+			cooldownFor("raw.githubusercontent.com", cooldown.until + 1),
+		).toBeNull();
+		expect(waitMs("raw.githubusercontent.com", cooldown.until + 1)).toBe(0);
+	});
+
+	it("keeps the two hosts on separate budgets", () => {
+		// They are separate buckets upstream. Blocking raw because the API is
+		// exhausted would stop work that would have succeeded.
+		recordRateLimit(
+			"api.github.com",
+			new Headers({ "retry-after": "60" }),
+			NOW,
+		);
+		expect(cooldownFor("api.github.com", NOW)).not.toBeNull();
+		expect(cooldownFor("raw.githubusercontent.com", NOW)).toBeNull();
+	});
+
+	it("clears the cooldown and the strike count on success", () => {
+		// Without resetting strikes, one bad afternoon pins the backoff at ten
+		// minutes for the rest of the session even though calls are succeeding.
+		recordRateLimit("raw.githubusercontent.com", undefined, NOW);
+		recordRateLimit("raw.githubusercontent.com", undefined, NOW);
+		recordSuccess("raw.githubusercontent.com");
+		expect(cooldownFor("raw.githubusercontent.com", NOW)).toBeNull();
+
+		const afterRecovery = recordRateLimit(
+			"raw.githubusercontent.com",
+			undefined,
+			NOW,
+		);
+		expect(afterRecovery.strikes).toBe(1);
+	});
+
+	it("lists active cooldowns soonest first", () => {
+		recordRateLimit(
+			"api.github.com",
+			new Headers({ "retry-after": "600" }),
+			NOW,
+		);
+		recordRateLimit(
+			"raw.githubusercontent.com",
+			new Headers({ "retry-after": "30" }),
+			NOW,
+		);
+		const active = activeCooldowns(NOW);
+		expect(active.map((c) => c.host)).toEqual([
+			"raw.githubusercontent.com",
+			"api.github.com",
+		]);
+	});
+});
+
+describe("remainingFromHeaders", () => {
+	it("reads the budget so a caller can stop before tripping the limit", () => {
+		expect(
+			remainingFromHeaders(new Headers({ "x-ratelimit-remaining": "51" })),
+		).toBe(51);
+		expect(remainingFromHeaders(new Headers())).toBeNull();
+	});
+});
+
+describe("formatWait", () => {
+	it("reads naturally at every scale", () => {
+		expect(formatWait(0)).toBe("0s");
+		expect(formatWait(45_000)).toBe("45s");
+		expect(formatWait(90_000)).toBe("2m");
+		expect(formatWait(3_600_000)).toBe("1h 0m");
+		expect(formatWait(4_320_000)).toBe("1h 12m");
+	});
+});

package/src/__tests__/gitignore-check.test.ts

@@ -0,0 +1,71 @@
+import { afterEach, beforeEach, describe, expect, it } from "bun:test";
+import { spawnSync } from "node:child_process";
+import { mkdir, mkdtemp, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { BUILTIN_DEFAULTS } from "../data/gitignore-defaults.js";
+import {
+	checkGitignore,
+	formatGitignoreWarning,
+} from "../services/gitignore-check";
+
+function git(cwd: string, ...args: string[]): void {
+	spawnSync("git", ["-c", "core.excludesFile=/dev/null", ...args], { cwd });
+}
+
+describe("checkGitignore", () => {
+	let projectDir: string;
+
+	beforeEach(async () => {
+		projectDir = await mkdtemp(join(tmpdir(), "gitig-check-"));
+	});
+
+	afterEach(async () => {
+		await rm(projectDir, { recursive: true, force: true });
+	});
+
+	it("returns 0 violations for non-git directory", async () => {
+		const r = await checkGitignore(projectDir);
+		expect(r.violationCount).toBe(0);
+	});
+
+	it("flags missing built-in patterns inside a fresh git repo", async () => {
+		git(projectDir, "init", "-q");
+		const r = await checkGitignore(projectDir);
+		// BUILTIN_DEFAULTS includes ".mnemex/" etc. — none are tracked, none in
+		// .gitignore, so each one becomes "missing-from-gitignore".
+		expect(r.violationCount).toBeGreaterThan(0);
+	});
+
+	it("returns 0 when .gitignore covers all built-in patterns and tracked files match track rules", async () => {
+		git(projectDir, "init", "-q");
+		git(projectDir, "config", "user.email", "t@t");
+		git(projectDir, "config", "user.name", "t");
+		// Suppress all built-in ignore rules. DERIVED from the constant, not a
+		// hand-copied list: a copy silently becomes a different assertion the
+		// moment a pattern is added, and then fails for a reason that has nothing
+		// to do with what this test is about.
+		await writeFile(
+			join(projectDir, ".gitignore"),
+			`${BUILTIN_DEFAULTS.ignore.join("\n")}\n`,
+		);
+		// Tracked files don't have to exist for the absent-track-path case to be ignored
+		const r = await checkGitignore(projectDir);
+		expect(r.violationCount).toBe(0);
+	});
+});
+
+describe("formatGitignoreWarning", () => {
+	it("returns null when no violations", () => {
+		expect(
+			formatGitignoreWarning({ violationCount: 0, warnings: [] }),
+		).toBeNull();
+	});
+
+	it("returns a warning string when violations exist", () => {
+		const w = formatGitignoreWarning({ violationCount: 3, warnings: [] });
+		expect(w).not.toBeNull();
+		expect(w).toContain("3 git state");
+		expect(w).toContain("Git State tab");
+	});
+});

package/src/__tests__/gitignore-detector.test.ts

@@ -0,0 +1,176 @@
+import { afterEach, beforeEach, describe, expect, it } from "bun:test";
+import { spawnSync } from "node:child_process";
+import { mkdir, mkdtemp, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { detectViolations } from "../services/gitignore-detector";
+import type { ResolvedManifest } from "../types/gitignore";
+
+function git(cwd: string, ...args: string[]): string {
+	// core.excludesFile=/dev/null bypasses the developer's global gitignore
+	// so the test environment doesn't leak into the result.
+	//
+	// commit.gpgsign=false is the same isolation, one step further: a developer
+	// with signed commits makes every `git commit` here call their signer. With
+	// 1Password's SSH agent that means a prompt or an agent error, so these tests
+	// failed or timed out locally for reasons that have nothing to do with the
+	// code under test. CI has no signing config, so it only ever broke locally.
+	const r = spawnSync(
+		"git",
+		[
+			"-c",
+			"core.excludesFile=/dev/null",
+			"-c",
+			"commit.gpgsign=false",
+			...args,
+		],
+		{
+			cwd,
+			encoding: "utf8",
+		},
+	);
+	if (r.status !== 0) {
+		throw new Error(`git ${args.join(" ")} failed: ${r.stderr}`);
+	}
+	return r.stdout;
+}
+
+async function makeRepo(): Promise<string> {
+	const dir = await mkdtemp(join(tmpdir(), "gitig-det-"));
+	git(dir, "init", "-q");
+	git(dir, "config", "user.email", "test@test");
+	git(dir, "config", "user.name", "test");
+	return dir;
+}
+
+function manifest(rules: ResolvedManifest["rules"]): ResolvedManifest {
+	return { rules, conflicts: [] };
+}
+
+describe("detectViolations", () => {
+	let repo: string;
+
+	beforeEach(async () => {
+		repo = await makeRepo();
+	});
+
+	afterEach(async () => {
+		await rm(repo, { recursive: true, force: true });
+	});
+
+	it("returns empty for non-git directory", async () => {
+		const tmp = await mkdtemp(join(tmpdir(), "gitig-nogit-"));
+		try {
+			const r = await detectViolations(
+				tmp,
+				manifest([{ pattern: ".env", action: "ignore", source: "builtin" }]),
+			);
+			expect(r).toEqual([]);
+		} finally {
+			await rm(tmp, { recursive: true, force: true });
+		}
+	});
+
+	it("flags tracked-but-should-ignore for a tracked file", async () => {
+		await writeFile(join(repo, "secret.txt"), "x");
+		git(repo, "add", "secret.txt");
+		git(repo, "commit", "-q", "-m", "add secret");
+
+		const r = await detectViolations(
+			repo,
+			manifest([
+				{ pattern: "secret.txt", action: "ignore", source: "project" },
+			]),
+		);
+		expect(r.length).toBe(1);
+		expect(r[0].kind).toBe("tracked-but-should-ignore");
+		expect(r[0].severity).toBe("destructive");
+		expect(r[0].path).toBe("secret.txt");
+	});
+
+	it("flags missing-from-gitignore when path neither tracked nor in .gitignore", async () => {
+		const r = await detectViolations(
+			repo,
+			manifest([{ pattern: ".env", action: "ignore", source: "builtin" }]),
+		);
+		expect(r.length).toBe(1);
+		expect(r[0].kind).toBe("missing-from-gitignore");
+		expect(r[0].severity).toBe("safe");
+	});
+
+	it("does NOT flag missing-from-gitignore when .gitignore already covers the path", async () => {
+		await writeFile(join(repo, ".gitignore"), ".env\n");
+		const r = await detectViolations(
+			repo,
+			manifest([{ pattern: ".env", action: "ignore", source: "builtin" }]),
+		);
+		expect(r).toEqual([]);
+	});
+
+	it("flags ignored-but-should-track when track rule is excluded by .gitignore", async () => {
+		await writeFile(join(repo, ".gitignore"), ".mcp.json\n");
+		await writeFile(join(repo, ".mcp.json"), "{}");
+		const r = await detectViolations(
+			repo,
+			manifest([{ pattern: ".mcp.json", action: "track", source: "builtin" }]),
+		);
+		expect(r.length).toBe(1);
+		expect(r[0].kind).toBe("ignored-but-should-track");
+		expect(r[0].severity).toBe("destructive");
+	});
+
+	it("flags untracked-and-should-track when path exists but isn't tracked", async () => {
+		await writeFile(join(repo, ".mcp.json"), "{}");
+		const r = await detectViolations(
+			repo,
+			manifest([{ pattern: ".mcp.json", action: "track", source: "builtin" }]),
+		);
+		expect(r.length).toBe(1);
+		expect(r[0].kind).toBe("untracked-and-should-track");
+		expect(r[0].severity).toBe("destructive");
+	});
+
+	it("does NOT flag track rule when path is already tracked", async () => {
+		await writeFile(join(repo, ".mcp.json"), "{}");
+		git(repo, "add", ".mcp.json");
+		git(repo, "commit", "-q", "-m", "add mcp");
+		const r = await detectViolations(
+			repo,
+			manifest([{ pattern: ".mcp.json", action: "track", source: "builtin" }]),
+		);
+		expect(r).toEqual([]);
+	});
+
+	it("matches directory patterns against tracked subpaths", async () => {
+		await mkdir(join(repo, "ai-docs", "sessions"), { recursive: true });
+		await writeFile(join(repo, "ai-docs", "sessions", "leak.md"), "x");
+		git(repo, "add", "ai-docs/sessions/leak.md");
+		git(repo, "commit", "-q", "-m", "leak");
+
+		const r = await detectViolations(
+			repo,
+			manifest([
+				{ pattern: "ai-docs/sessions/", action: "ignore", source: "builtin" },
+			]),
+		);
+		expect(r.length).toBeGreaterThan(0);
+		expect(r[0].kind).toBe("tracked-but-should-ignore");
+		expect(r[0].path).toBe("ai-docs/sessions/leak.md");
+	});
+
+	it("returns no violations when manifest is satisfied", async () => {
+		await writeFile(join(repo, ".gitignore"), ".env\n");
+		await writeFile(join(repo, ".mcp.json"), "{}");
+		git(repo, "add", ".gitignore", ".mcp.json");
+		git(repo, "commit", "-q", "-m", "init");
+
+		const r = await detectViolations(
+			repo,
+			manifest([
+				{ pattern: ".env", action: "ignore", source: "builtin" },
+				{ pattern: ".mcp.json", action: "track", source: "builtin" },
+			]),
+		);
+		expect(r).toEqual([]);
+	});
+});